SQL Injection Vulnerability in DELL EMC Avamar Server Software
CVE-2020-29493

10CRITICAL

Key Information:

Vendor
Dell
Status
Avamar
Vendor
CVE Published:
14 January 2021

Summary

A SQL injection vulnerability exists in DELL EMC Avamar Server’s Fitness Analyzer, which could be exploited by an unauthenticated remote attacker. This flaw allows for the execution of arbitrary SQL commands against the backend database, potentially granting unauthorized access to sensitive application data. Such exploitation could result in the leakage, alteration, or deletion of critical backup data. DELL EMC recommends that users update to the latest versions to mitigate these risks.

Affected Version(s)

Avamar < unspecified

References

https://www.dell.com/support/kbdoc/en-us/000181806/dsa-20...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.